From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Sat, 16 Aug 2008 22:05:11 +0000 (-0700)
Subject: another .26 patch
X-Git-Tag: v2.6.26.3~15
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=495d1105ebf902cac33c3c1fc47925e22efcb0f8;p=thirdparty%2Fkernel%2Fstable-queue.git

another .26 patch
---

diff --git a/queue-2.6.26/dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch b/queue-2.6.26/dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch
new file mode 100644
index 00000000000..075a04f7108
--- /dev/null
+++ b/queue-2.6.26/dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch
@@ -0,0 +1,35 @@
+From 3e8a0a559c66ee9e7468195691a56fefc3589740 Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Wed, 13 Aug 2008 13:48:39 -0700
+Subject: dccp: change L/R must have at least one byte in the dccpsf_val field
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+commit 3e8a0a559c66ee9e7468195691a56fefc3589740 upstream
+
+Thanks to Eugene Teo for reporting this problem.
+
+Signed-off-by: Eugene Teo <eugenete@kernel.sg>
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/dccp/proto.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -476,6 +476,11 @@ static int dccp_setsockopt_change(struct
+ 
+ 	if (copy_from_user(&opt, optval, sizeof(opt)))
+ 		return -EFAULT;
++	/*
++	 * rfc4340: 6.1. Change Options
++	 */
++	if (opt.dccpsf_len < 1)
++		return -EINVAL;
+ 
+ 	val = kmalloc(opt.dccpsf_len, GFP_KERNEL);
+ 	if (!val)
diff --git a/queue-2.6.26/series b/queue-2.6.26/series
index 26ace459423..74a551189f0 100644
--- a/queue-2.6.26/series
+++ b/queue-2.6.26/series
@@ -21,3 +21,4 @@ ipvs-fix-possible-deadlock-in-estimator-code.patch
 acer-wmi-fix-wireless-and-bluetooth-on-early-amw0-v2-laptops.patch
 cifs-mount-of-ipc-breaks-with-iget-patch.patch
 cifs-if-get-root-inode-fails-during-mount-cleanup-tree-connection.patch
+dccp-change-l-r-must-have-at-least-one-byte-in-the-dccpsf_val-field.patch